PF dropping fragmented icmp6 packets
John Wright <[email protected]> Thu, 15 Jan 2004 14:29:30 +0000
| Newsgroups | gmane.os.openbsd.ipv6 |
|---|---|
| Message-ID | <[email protected]> |
I've having an odd problem with my ipv6 tunnel which seems to related to how
I've configured pf (running on OpenBSD 3.4 i386).
This is my pf.conf file:
set block-policy return
scrub in all
pass in all
pass out all
block in all
pass in on sis0 from 193.113.58.80 to 81.6.214.188
pass in on sis1 inet6
pass in on gif0 inet6 proto icmp6
pass in on gif0 inet6 proto tcp from any to 2001:618:409::/48 port 22
pass in on gif0 inet6 proto tcp from any to 2001:618:409::/48 port 80
pass out on gif0 inet6 proto { tcp, udp } from 2001:618:409::/48 to any keep state
If I do a ping6 with a packet size greater than the mtu of the gif0
interface (which is 1280) then I won't see any ping replies.
If I change the pf.conf to pass in all; pass out all; then I do see the ping
replies.
Is an ipv6-icmp6 fragmented packet using a different protocol or is it pf
that's a little confused?
I've tried without the scrub rule also but that doesn't fix this.